Hanno Böck

A denial of service issue exists where the billion laughs protection in the `accountingDiffTolerated()` function within `xmlparse.c` detects entity amplification too late. This allows attackers to provide a moderately sized XML document containing a large Document Type Definition (DTD) and nested entity expansions, causing the system to consume significant CPU resources for tens of seconds during parsing.

The issue arises because Dovecot accepts the dot LF DOT LF symbol as the end of the DATA command, whereas the RFC requires it to be CR LF DOT CR LF. This discrepancy causes Dovecot to split a single email containing LF DOT LF in the middle into two separate emails when relaying to SMTP. As a result, emails with LF DOT LF are divided into two mails.

The issue concerns the email module in CPython, which did not properly quote newlines for email headers when serializing an email message. This allows for header injection when an email is serialized, potentially enabling a remote authenticated attacker to spoof sender identity, gain unauthorized email sending, or cause loss of control over email communication by persuading a victim to open a specially crafted email.

The issue concerns alpitronic Hypercharger EV charging devices that can expose a web interface protected by authentication if misconfigured. If the default credentials are not changed, an attacker can use public knowledge to access the device as an administrator.

A predictable HTTP digest authentication nonce value was generated using the `rand()` function.

The issue is related to the implementation of the HSTS (HTTP Strict Transport Security) mechanism in Mozilla products, specifically concerning inadequate access control. This could allow a remote attacker to bypass security mechanisms in specific HSTS configurations, potentially on a subdomain.

The issue is related to the generation of RSA keys that can be broken with Fermat's factorization method, allowing efficient calculation of private RSA keys from the public key of a TLS certificate. This is due to the use of insufficiently random values in the CLS PK KeyGenMT() function of the Rambus SafeZone Basic Crypto Module.

The issue is related to Fetchmail's failure to enforce STARTTLS session encryption under certain circumstances, such as with IMAP and PREAUTH.

The issue is related to the STARTTLS feature in Exim, which allows response injection during MTA SMTP sending. This is due to insufficient neutralization of special elements in the request. The exploitation of this issue may allow a remote attacker to impact data integrity.

An issue was discovered in the usage of the insecure `rand()` function within the process of generating the 2FA secret.

An issue was discovered in the usage of an insufficient length for the 2FA secret according to RFC 4226, where 10 bytes were used instead of the recommended 20 bytes.

An issue was discovered in the core shipped but unused randval implementation within FOF (FOFEncryptRandval), which used a potentially insecure implementation. This has been replaced with a call to `random bytes()` and its backport that is shipped within random compat.

The issue is related to the `raptor xml writer start element common` function in the Raptor RDF Syntax Library, which miscalculates the maximum number of nspace declarations for the XML writer. This can lead to heap-based buffer overflows, sometimes seen in the `raptor qname format as xml` function. The vulnerability can be exploited by a remote attacker to compromise data integrity or cause a denial of service.

A directory structure of more than 1000 nested directories can interrupt a freewvs scan due to Python's recursion limit and `os.walk()`. This can be problematic when an administrator scans directories of potentially untrusted users.

The issue arises from the `compose.php` file in SquirrelMail, which calls `unserialize` for the `$mailtodata` value. This value originates from an HTTP GET request, making it a potential entry point for exploitation. The vulnerability is related to the `mailto.php` file.

The issue arises in compose.php, where the $attachments value from an HTTP POST request is passed to unserialize. This could potentially lead to PHP object injection. However, the vendor disputes this, citing that two necessary conditions for such an injection are not met: the existence of a PHP magic method like wakeup or destruct, and the declaration or autoloading of attack-relevant classes before unserialize is called.

The issue is related to the handling of MIME parts in GNU Mailman, which may contribute to cross-site scripting (XSS) attacks against visitors of list archives. This occurs because an HTTP reply from an archive web server may lack a MIME type, leading a web browser to perform MIME sniffing and potentially execute JavaScript code. The vulnerability is also related to the lack of protection for the web page structure, which could allow a remote attacker to impact data integrity.

The issue allows adding an arbitrary Cascading Style Sheets (CSS) token sequence to a page through BBCode.

The issue is related to an input validation vulnerability that allows for code execution.

A Cross-site Scripting (XSS) issue exists in the tagcloud parameter to "plugins/serendipity event freetag/tagcloud.swf". This allows for potential exploitation.